COVID-19: OCR Issues New HIPAA Guidance for Contacting Recovered Patients
The United States Department of Health and Human Services Office for Civil Rights (OCR) issued updated guidance regarding contacting former COVID-19 positive patients about blood plasma donation, as related to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy protections. The guidance allows healthcare providers and covered entities to use protected health information (PHI) to identify and contact former COVID-19 positive patients to provide information on donating blood plasma to treat patients with COVID-19, as long as the information is not used for marketing purposes (“marketing” as defined by HIPAA).
Changes to HIPAA Privacy Rule
The HIPAA Privacy Rule allows covered entities or their business associates to use or disclose PHI for treatment, payment, and healthcare operations, without the individual patient’s authorization. When using or disclosing PHI, the covered entity or business associate must make reasonable efforts to limit the use or disclosure to the minimum necessary to accomplish the intended purpose. According to the new guidance, using PHI to identify and contact patients who have recovered from COVID-19 to inform them about blood plasma donation is a permitted healthcare operations activity, and does not require the individuals’ prior authorization. Increasing the supply of this blood plasma would enhance a health care provider’s ability to conduct case management activities for COVID-19 positive patients.
In order to not run afoul of HIPAA’s anti-marketing rule, the covered entity must not encourage the use of a third party’s blood or plasma donation center, and the covered entity must not disclose PHI to a third party for the purpose of that third party to send marketing communications regarding the third party’s products or services, without the patient’s prior authorization. This includes not disclosing to a third party center any information regarding individuals who have recovered from COVID-19 for the donation center’s marketing purposes.
Under HIPAA, prohibited “marketing activities” does not include a covered entity’s communication regarding its own blood or plasma donation centers. This would fall under the entity’s own healthcare products and services, and the new guidance does not limit the entity’s ability to inform patients of its own donation centers.
Regulatory Outlook
With the new FDA approval of COVID-19 treatment using recovered patients’ blood plasma, as well as any additionally discovered treatments in the future, new regulatory concerns will arise around the use of any treatments for the virus. Healthcare providers, insurers, and any other covered entities will need to remain vigilant and informed on any regulatory concerns resulting out of new and/or improved treatments as the world battles the pandemic.
